Weaknesses of type CWE-400

2,640 results

Consumo descontrolado de recursos (Esgotamento de recursos)

A aplicação não limita ou valida adequadamente a quantidade de recursos (memória, CPU, conexões, espaço em disco) que um usuário ou processo pode consumir. Um atacante explora isso enviando requisições malformadas ou em grande volume para esgotar os recursos disponíveis, causando indisponibilidade do serviço.

Example

Um servidor web aceita uploads sem limite de tamanho ou número simultâneo de conexões. Um atacante envia centenas de uploads gigantescos ou mantém conexões abertas indefinidamente, preenchendo a memória e o disco até o servidor travar e ficar inacessível para usuários legítimos.

How to mitigate

Implemente limites explícitos: tamanho máximo de requisição/upload, timeout de conexão, máximo de conexões simultâneas, rate limiting. Monitore consumo de recursos e configure alertas. Use pools de conexão e libere recursos automaticamente após uso.

CVE-2020-8277—A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versiEPSS 54.2%CVE-2021-28165HIGHIn Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invaEPSS 53.9%CVE-2026-49160HIGHHTTP.sys Denial of Service VulnerabilityEPSS 53.8%CVE-2022-31698MEDIUMThe vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port EPSS 47.8%CVE-2024-5011HIGHWhatsUp Gold TestController Chart denial of service vulnerabilityEPSS 47.1%CVE-2018-16843MEDIUMnginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption.EPSS 47.1%CVE-2020-2039MEDIUMPAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file uploadEPSS 46.4%CVE-2019-5645HIGHRapid7 Metasploit HTTP Handler Denial of ServiceEPSS 41.7%CVE-2018-12122—Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial EPSS 41.3%CVE-2016-8610—A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processiEPSS 39.7%CVE-2017-6019—An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830. A series of rapid EPSS 36.9%CVE-2018-5391—The Linux kernel, versions 3.9+, IP implementation is vulnerable to denial of service conditions with low rates of specially modified packetsEPSS 32.4%CVE-2016-8858HIGHThe kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consEPSS 29.5%CVE-2019-9517HIGHSome HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of serviceEPSS 27.9%CVE-2023-23590HIGHMercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated EPSS 26.4%CVE-2019-9518HIGHSome HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of serviceEPSS 25.4%CVE-2026-34648HIGHAdobe Commerce | Uncontrolled Resource Consumption (CWE-400)EPSS 22.6%CVE-2026-0599HIGHUnbounded External Image Fetch in Validation Leads to Resource-Exhaustion DoS in huggingface/text-generation-inferenceEPSS 22.5%CVE-2017-0938—Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplificatiEPSS 21.0%CVE-2025-67779HIGHIt was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attacEPSS 20.3%